AUDIT-2026-05-06 M-4 fix from the aldabra Phase 3-6 audit.
NonEmptyKeyValuePairs::decode in pallas-codec accepts `0xa0`
(empty CBOR map) because the upstream empty-map check is commented
out. That decoded value re-encodes correctly and passes through
pallas-txbuilder, but the resulting Conway tx fails ledger validation
at submit time with a non-obvious error.
Add a debug_assert_ne! on the builder method input + clear doc note
warning callers to omit the field instead of passing an empty map.
Release builds pass through (no overhead); dev/test builds catch
accidental empty-map calls with a clear panic message.
The pre-existing aldabra build_signed_drep_vote_cast always
constructs a non-empty map so it doesn't trip this; the guard is for
future callers.
Fills the third of pallas-txbuilder's Conway TODOs (after auxiliary_data
+ certificates):
- StagingTransaction gains `voting_procedures: Option<Vec<u8>>` (opaque
CBOR — same Eq-derive workaround as auxiliary_data + certificates)
- Builder methods .voting_procedures(cbor_bytes) + .clear_voting_procedures()
- conway::build_conway_raw decodes via VotingProcedures::decode_fragment
and assigns to TransactionBody.voting_procedures
VotingProcedures is itself a NonEmptyKeyValuePairs<Voter,
NonEmptyKeyValuePairs<GovActionId, VotingProcedure>> map, so callers
pre-assemble the full map and encode once.
Tests:
- voting_procedures_plumb_through_to_tx_body — encode DRepKey vote-Yes
on a synthetic GovActionId, build, decode, assert round-trip
- no_voting_procedures_means_none — negative path
second of the upstream TODOs. addresses the `// pub certificates: TODO`
comment in transaction/model.rs and the `certificates: None, // TODO`
in conway.rs:243.
implementation:
- new field: pub certificates: Option<Vec<Vec<u8>>> on StagingTransaction.
cbor bytes per cert (each entry is conway::Certificate) — same opaque-
bytes pattern as auxiliary_data, for the same reason (Certificate
doesn't impl Eq).
- builder: .add_certificate(cbor_bytes) and .clear_certificates().
- conway::build_conway_raw decodes each entry via
Certificate::decode_fragment + plumbs into TransactionBody.certificates
via NonEmptySet::from_vec. fragment-decode failures map to
TxBuilderError::CorruptedTxBytes (same as aux_data path).
tests:
- certificates_plumb_through_to_tx_body: encodes a
StakeRegistration(AddrKeyhash([7;28])), attaches, builds, decodes
resulting tx, asserts the cert round-trips byte-for-byte.
- no_certificates_means_none: confirms unset path keeps
body.certificates None (no spurious empty Set).
unblocks aldabra phase 4.6 stake delegation. PR upstream still pending;
this is part of the same vendored fork as the auxiliary_data work.
addresses the four TODO comments in pallas-txbuilder/src/transaction/model.rs
and conway.rs around auxiliary_data + auxiliary_data_hash. without this the
conway builder hardcodes auxiliary_data: None, which blocks CIP-20 / CIP-25
/ CIP-68 metadata.
implementation:
- new StagingTransaction field: pub auxiliary_data: Option<Vec<u8>>.
stored as opaque cbor bytes (caller encodes alonzo::AuxiliaryData) since
AuxiliaryData itself doesn't impl Eq, which the rest of StagingTransaction
requires.
- builder methods .auxiliary_data(cbor) and .clear_auxiliary_data().
- conway::build_conway_raw now decodes the bytes back into
AuxiliaryData::decode_fragment and plugs it into pallas_tx.auxiliary_data.
the existing auxiliary_data_hash population block is unchanged — it
already computes the hash from pallas_tx.auxiliary_data after assignment.
- decode failures map to TxBuilderError::CorruptedTxBytes.
tests:
- auxiliary_data_round_trips_through_build: encodes a CIP-25-shaped
metadata, attaches, builds, decodes resulting tx, asserts both
body.auxiliary_data_hash matches expected_hash.compute_hash() and the
aux re-encodes byte-equivalent.
- no_auxiliary_data_means_no_hash: confirms the absence path still works
(no aux → hash field stays None).
both pre-existing tests (staging_json_roundtrip, built_json_roundtrip,
test_script_data_hash) continue to pass — the new field defaults to None
and rides alongside.
PR upstream pending; using as a vendored patch via [patch.crates-io] on
the Sulkta side until merge.
* Re-organize and clean-up pallas-primitives
Namely:
- Move _common_ (i.e. era-independent) types and structures up to the
`lib` module; to be shared across all eras. If any of those deviate
in a subsequent era, it is easy to bring them down and define new
types from the point of divergence onward. This simplifies the scope
of each era-specific module and make them slightly easier to
navigate.
Note that, each era module still re-export all of the common types
that's relevant to that particular era. So technically, this
reorganization doesn't really change anything for callers/users of
the library.
- Rename `Scripthash` to `ScriptHash`. Before this commit, both
actually existed as `ScriptHash` was introduced with the Conway era.
Yet, they refer to the same thing, so the duplication is simply
confusing.
- Rename `One` / `Two` constructors for `NetworkId` to `Testnet` and
`Mainnet` respectively. Also defined idiomatic `From` & `TryFrom`
implementation for conversion to and from `u8`. This is a lot let
confusing!
- Generalize `PlutusScript` with a constant generic, to avoid
repetition for each plutus script generated for specific version.
Note that a distinction is still _necessary_ if we want to provie
out-of-the-box serialisers for Plutus scripts, which are serialised
with a tag prefix depending on the language. All else apart, they
are strictly similar types.
- Rename `CostMdls` to `CostModels`. Because, common.
- Rename `plutus_script` to `plutus_v1_script` in the Alonzo's witness
set, for consistency with other eras.
* Fix ordering of ScriptHash variants.
This is an odd one. See the note.
* Bump minicbor to v0.25.1
* Add aliases with deprecation warnings to various fields and types.
* revert renaming plutus_script to plutus_v1_script in Alonzo witness
See https://github.com/txpipe/pallas/pull/523#discussion_r1807329742
